IT Security

This document discusses two topics in IT security: the Facebook security breach in 2018 and the problem of asynchronous I/O activity. It provides an overview of the incidents, their impact, and possible solutions. The document also includes a report on the 2011 Sony PlayStation Network attack.

Running head: IT SECURITY
IT Security
Name of the Student
Name of the University
Author Note:

IT SECURITY
Table of Contents
Part A...............................................................................................................................................3
1a. Facebook security breach 17th March 2018..............................................................................3
Problem identified.......................................................................................................................3
Occurrence of the incident...........................................................................................................4
Reason behind occurrence...........................................................................................................4
Possible solutions.........................................................................................................................5
1b. Explain why asynchronous I/O activity is a problem with many memory protection schemes,
including base/bounds and paging. Suggest a solution to the problem...........................................5
Part B: Report on 2011 Sony PlayStation Network.........................................................................7
Problem........................................................................................................................................7
Impact of the attack.....................................................................................................................8
Procedure of attack......................................................................................................................8
Mitigation step.............................................................................................................................8
Reference.........................................................................................................................................9

IT SECURITY
Part A
1a. Facebook security breach 17th March 2018
Problem identified
The security breach occurred in the year 2018 when the personal data of the Facebook
users were compromised and the data were used for political purposes. The users of the accounts
were not aware of this security attack and this security attack resulted in the massive fall of
Facebook stock price. The regulations of this global organization were needed to be revised in
order to deal with future security breaches. This data security breach helped president Donald
Trump to win the general election in the year 2014. The personal data of the users were
compromised the data was used in favor of Donald Trump in his presidential campaign. This
security breach was first reported in the year 2015 by a renowned journalist known as Harry
Davies [5]. The identified problem in this security breach is the security of the user data of
Facebook. Huge amount of data are circulated between the Facebook users for different types of
purposes and these type of security issues can have a significant impact on the reputation this
global organization [1].
This security breach breached the data protection laws and regulations, at the same time it
can be also said that the professional code of code were not maintained by the social engineer
due to this attack. The Facebook users all around the world were very much worried after this
security breach as numerous small and medium sized business organization uses this social
media platform to share essential information to all of its shareholders who are located outside
the working environment [6]. So, it can be said that this security breach have a negative effect on
both the users as well as for the organization as well.

IT SECURITY
Occurrence of the incident
According to the investigative sources it can be said that at least 50 million user accounts
of Facebook were compromised. The cybercriminals exploited a vulnerability of Facebook,
which helped them to get access to the personal data of the users. However, the security experts
of Facebook were able to secure around 40 million additional accounts. The data of the
compromised users were altered and used improperly to promote Donald Trump [7]. The API
used by the developers of Facebook were also used by the cyber criminals of the attack. The
“OAuth bearer tokens" of Facebook was stolen by the cybercriminals and these tokens were used
to steal the private data of the compromised accounts [2]. The "View As" feature of Facebook
was also compromised by the hackers prior to this security breach. The technical skills of the
social engineers who were responsible for this attack were very much high.
Reason behind occurrence
The name, gender and the hometowns of the Facebook users were compromised and
altered by the cybercriminals. The security bug in the API of Facebook is the main reason behind
this attack. The access tokens which are set by the browsers or the device used by the Facebook
users. The vulnerabilities of the Facebook systems were capitalized by cybercriminals. The
private information of the users was used illegally by the criminals and the personal data had a
direct impact on the general elections of USA [8]. Investigation also helps in identifying the role
of the Russian operatives in this security breach as well. This security breach does not just
violate the privacy of the user data but also have an indirect impact on the national economy as
well.

IT SECURITY
Possible solutions
The prime solution for this security issue is securing the Facebook access token as any
compromise in the access tokens can have a devastating effect on the Facebook users [3]. The
private data, as well as the application and games which are connected to Facebook, can be
managed by the social engineers if they get the access to the tokens.
As an emergency security step the Facebook authorities re-setted the access tokens of all
the infected users as a result the users were logged out of their Facebook accounts. The security
issues of Facebook was mitigated by the high end developers of this organization. The
cybersecurity laws of USA was also reconsidered after a court filing complaints about the
improper data gathering practice [4]. The security of the user access tokens, as well as the
application access tokens, can be the best practice to deal with the future security breaches on
Facebook. The page access token and client token of Facebook must be also secured in order to
deal with the vulnerabilities of the user accounts. The generation of the application access tokens
using the graph API must be done using the API call.
1b. Explain why asynchronous I/O activity is a problem with many memory
protection schemes, including base/bounds and paging. Suggest a solution to
the problem.
The asynchronous I/O activity is a huge concern regarding the memory protection
schemes including the base and the paging techniques. The I/O operations can be defined as they
form of input-output processing that permits the other processing's to continue before the
finishing of the transmission. The asynchronous I/O activity is a very slow process as compared
with the processing of the data. The incorporation of the mechanical devices such as a hard drive

IT SECURITY
which helps in seeking a track to read or write. The order of magnitude of the asynchronous is
also slower than the switching of electric current [11]. There are numerous complexities of disk
operations in the asynchronous I/O activity.
There are different types of memory protection schemes which are used to improve
memory management. The memory access rights can be controlled with the help of the memory
protection schemes, this helps in improving the efficiency of the operating systems. The
architectures of the Operating System can be also improved using the memory protection
schemes and the asynchronous I/O activity can delay this entire procedure.
Considering the bounds are concerned it can be said that the prime concern of the
asynchronous I/O activity is the communication bottleneck. The communication bottleneck
delays all the activities of the Operating System. There are bandwidth issues for most of the
asynchronous I/O activities. The asynchronous I/O activity requires additional control lines.
Handshaking protocol is also required to control the upper and the lower limit of the bound
registers. The handling of the interrupt is not done in an efficient way which is also a concern
regarding the asynchronous I/O activity. The prevention of any instruction from getting
completed is also a serious concern considering the asynchronous I/O activity. The other
disadvantage of asynchronous I/O activity is that the data is needed to be saved prior to servicing
of the interrupt
The ability of relocation are generally provided by the fence register. The separation of
two user areas is generally done by the base address which is always provided in the first place.
All the programs in the specific user area are offset from the base address [10]. If a user exceeds
the address space, in that there is a need of limiting the upper bound. Any specific users must not

IT SECURITY
be getting the access of the area of the other users. The upper bound register is termed as the
bound register. The integrity of the data are shared needed to be maintained in the first place with
the help of the bound or the base register.
The upper and the lower limits of the area specific to the user are maintained by the base
and bound registers, this technique can be very much important to protect the single uses are
with the area of the other users.
Paging helps in dividing a program into smaller fragments, each fragment are off equal
sizes. The pages and the memory are divided into page frames. With the help of this procedure
the page table name, related memory address are stored [9]. The offset values can be accessed
with the help of this table, thus the page table can be very much useful to access the offset values
as well as the different addresses.
Part B: Report on 2011 Sony PlayStation Network
Problem as a result of the attack
Occurred between 17th April 2011 and 19th April 2011, this attack on the play station
network of Sony is one of the most deadly security attacks in the last 10 years. The problem in
the network of Sony PlayStation is primarily responsible for this network outage. As a result of
this security issue, it can be said that the gamers of the Sony PlayStation network lost their user
names which they use in different games, residential addresses, email addresses, birthdates, login
credentials as well as the security questions. The exposed data also had a negative impact on the
payment system of the Sony PlayStation network as the debit cards details and the credit card
details were compromised. As a result of this security attack, the market reputation of Sony was

IT SECURITY
badly damaged. The main problems faced by the users of the Sony PlayStation network due to
this security attack are identity loss as well as financial loss.
Impact of the attack
The Play Station network of Sony was compromised in this network outage, at the same
time it can be also said that the Criocity service of Sony was also negatively affected as a result
of this security attack.
According to the investigative sources it was found that 77 million accounts were
compromised in this security attack. The social engineers who were involved in this attacked
prevented the users of the Play Station 3 to get access to the system [14]. The users of the
PlayStation Portable consoles also could not get access to the system due to this network outage.
The entire PlayStation service was disrupted due to this security attack which was conducted in
the year 2011.
Procedure of attack
The attack was carried out by a malicious social engineer who hacked the entire network
of Play Station 3 [12]. The users and all of their personal data were compromised due to this
security attack. This attacked can be categorized as the external intrusion where the network
servers of the PlayStation were compromised.
Mitigation step
As mentioned by Velez-Castrillon and Angert (2015), the vulnerabilities associated with
the payment gateways such as PayPal must have been identified on the first place by the
management team of Sony with the help of the professional IT risk management team [15]. The
researcher stated that the account statements for each of the stakeholders associated with the

IT SECURITY
Sony PlayStation network could have been checked so that the organization can identify the
security threats coming from inside the organization.
The concepts of cryptographic algorithm such as public key cryptography can be very
much useful to protect the payment gateways which are integrated in the PlayStation network
such as PayPal as mentioned by the researcher. The plain texts could have been changed into
ciphertexts as it will help in protecting the financial transactions of this PlayStation network [16].
Cryptographic algorithms such as RSA algorithm and triple DES encryption can be also useful in
the encryption procedures as stated by the researcher.
As discussed by Milburn (2017), the CVE information of all the devices used in the play
station network of Sony must have been studied by the IT risk response team as the
vulnerabilities of all the networking devices are clearly mentioned in the CVE websites. The use
of the whitelisting application in the working environment of SONY could have also prevented
this security issue as mentioned by the researcher. Network segmentation and monitoring
practice could have also prevented this network outage, as a result, billions of dollar was lost for
this organization [13]. A secure computing environment could have been very much beneficial
for Sony to prevent these type of network outages as well as the secure computing environment
can be very much important not only to deal with the network outages but also to deal with the
cybersecurity threats such as the threat coming from ransomeware [11]. The security features of
the trusted operating systems such as the discretionary access control, object re-use protection,
trusted path, accountability, and audit could have been incorporated in the IT environment of
Sony Play Station network in order to deal with security threats such as the network outage.

IT SECURITY

IT SECURITY
Reference
[1] JM. Green. Risk radar: Security breach. Company Director, 34(5), p.30, 2018
[2] K. Knautz, K. and K.S. Baran. Facets of Facebook: use and users. de Gruyter, 2016
[3] MM. Rahman, M.M. and MA. Adnan, M.A.January. Two step verification system of highly
secure social media: Possible to breach the security. In 2017 International Conference on
Networking, Systems and Security (NSysS) (pp. 185-190). IEEE, 2017
[4] N. Vemprala, N. and G. Dietrich. January. A Social Network Analysis (SNA) Study On Data
Breach Concerns Over Social Media. In Proceedings of the 52nd Hawaii International
Conference on System Sciences, 2019
[5] P.K. Sari, P.K. and A. Prasetio. Comparison Analysis of Information Security Awareness
Among Social Media Users in Indonesia. Advanced Science Letters, 23(5), pp.4306-4309, 2017
[6] R. Jabee, and M. Afshar. Issues and challenges of cyber security for social networking sites
(Facebook). International Journal of Computer Applications, 144(3), pp.36-40, 2016
[7]S. Laube and R. Böhme. The economics of mandatory security breach reporting to authorities.
Journal of Cybersecurity, 2(1), pp.29-41, 2016
[8] T. Dehling, S. Lins, S. and A. Sunyaev. Security of Critical Information Infrastructures. In
Information Technology for Peace and Security (pp. 319-339). Springer Vieweg, Wiesbaden,
2019
[9] K.H. Kim and J. Lee, SAP SE. Transaction commit operations with thread decoupling and
grouping of i/o requests. U.S. Patent Application 14/255,807, 2015

IT SECURITY
[10]P. Harrington, W. Yoo, A. Sim and K. Wu. Diagnosing Parallel I/O Bottlenecks in HPC
Applications. In International Conference for High Performance Computing, Networking,
Storage and Analysis (SCI7), ACM Student Research Competition (SRC), 2017
[11] A. Natanzon, L. Ayzenbergv, Y. Mossel, I. Singer and O. Kedem, EMC Corp. Dynamically
switching between synchronous and asynchronous replication. U.S. Patent 9,639,592, 2017
[12] S. Goode, H. Hoehle, V. Venkatesh, and S.A. Brown. User compensation as a data breach
recovery action: An investigation of the Sony PlayStation Network breach. MIS Quarterly,
41(3), 2017
[13] C. Milburn. Long live play: The PlayStation Network and technogenic life. In Research
Objects in their Technological Setting (pp. 117-134). Routledge, 2017
[14] M. Davies, H. Read, K. Xynos and I. Sutherland. Forensic analysis of a Sony PlayStation 4:
A first look. Digital Investigation, 12, pp.S81-S89, 2015
[15] J.P. Marshall and F. da Rimini. Playstation, Demonoid and the orders and disorders of
Pirarchy. Krisis: Journal for contemporary philosophy, 2015
[16] S. Velez-Castrillon and C. Angert. How Sony Got its Groove Back: A Case Study in
Turnaround Management. Business Education Innovation Journal, 7(2), 2015